Checks

CloudTrail trails that are logging are evaluated for Insights via insight selectors, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.

AWS CloudTrail trails are evaluated for use of SSE-KMS with a customer-managed KMS key to encrypt delivered log files at rest in S3. Trails without a configured KMS key are identified. Applies to single-Region and multi-Region trails.

AWS CloudTrail trails are evaluated for log file integrity validation being enabled (LogFileValidationEnabled).

When enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.

CloudTrail trails deliver logs to an S3 bucket; this evaluates whether that bucket has S3 server access logging enabled to record requests against it.

If the destination bucket is outside the account or audit scope, a manual review is indicated.

CloudTrail log destination S3 buckets are inspected for ACL grants that expose data to the public AllUsers group.

Buckets hosted in other accounts are flagged for out-of-scope review.

AWS CloudTrail has at least one trail with logging enabled in every region. A multi-region trail or a regional trail counts for coverage in that region.

CloudTrail trails record management events (read and write) in every AWS region and are actively logging, using a multi-region trail or per-region coverage.

CloudTrail trails log S3 object-level read data events for all buckets, capturing object access (for example GetObject) via selectors targeting AWS::S3::Object

CloudTrail trails include S3 object-level data events for write (or all) operations across all current and future buckets, via classic or advanced selectors. This records actions like PutObject, DeleteObject, and multipart uploads at the object level.

CloudTrail activity is analyzed for AWS identities executing a broad mix of discovery APIs like List*, Describe*, and Get* within a recent time window.

An identity exceeding a configurable ratio of these actions indicates potential enumeration behavior by that principal.

CloudTrail Bedrock activity is analyzed per identity for a high diversity of LLM-related API calls (e.g., InvokeModel, InvokeModelWithResponseStream, GetFoundationModelAvailability). If an identity's share of these actions exceeds a configured threshold over a recent window, it is surfaced as potential LLM-jacking behavior.

CloudTrail activity is analyzed for identities executing high-risk actions linked to privilege escalation (e.g., Attach*Policy, PassRole, AssumeRole, CreateAccessKey). Identities exceeding a configurable share of such events within a recent time window are highlighted for investigation.

Amazon CloudWatch metric alarms are evaluated for actions configured for the ALARM state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.

CloudWatch metric alarms are evaluated for alarm actions activation (actions_enabled: true), enabling state changes to invoke configured notifications or automated responses.

CloudTrail records for Network ACL changes are matched by a CloudWatch Logs metric filter with an associated alarm for events like CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, ReplaceNetworkAclEntry, and ReplaceNetworkAclAssociation.

CloudWatch log metric filters and alarms for network gateway changes are identified by matching CloudTrail events such as CreateCustomerGateway, DeleteCustomerGateway, AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, and DetachInternetGateway in log groups that receive trail logs.

VPC route table changes are captured from CloudTrail logs by a CloudWatch Logs metric filter with an associated alarm for events like CreateRoute, CreateRouteTable, ReplaceRoute, ReplaceRouteTableAssociation, DeleteRoute, DeleteRouteTable, and DisassociateRouteTable.

CloudTrail events for VPC configuration changes are captured in CloudWatch Logs with a metric filter and an associated alarm. The filter targets actions like CreateVpc, DeleteVpc, ModifyVpcAttribute, and VPC peering operations to surface when network topology is altered.

Amazon CloudWatch cross-account sharing via the CloudWatch-CrossAccountSharingRole allows other AWS accounts to view your metrics, dashboards, and alarms. The presence of this role indicates that sharing is active.

Log groups holding Bedrock AgentCore agent telemetry have an active CloudWatch Logs data protection policy, so sensitive data an agent writes to its own logs is masked at ingestion. A policy attached to the log group or inherited from an account-level policy both satisfy this.

CloudWatch log groups are assessed for at-rest encryption by checking if an AWS KMS key is associated with the log group via kmsKeyId.

CloudWatch Logs log groups are analyzed for potential secrets embedded in log events across their streams. Detection flags patterns resembling credentials (API keys, passwords, tokens, keys) and reports the secret types and where they appear within the log group.

CloudWatch Log Groups with resource policies that grant access to any principal are identified. Statements using Principal:"*" or wildcard Resource that reference a log group ARN indicate that the log group is exposed through a public policy.

CloudWatch Log Groups are assessed for a retention period at or above the configured threshold (e.g., 365 days) or for being set to never expire. Log groups with shorter retention are identified.